Enum Capability 

#[repr(u16)]
pub enum Capability {
    LocalRead = 1,
    LocalWrite = 2,
    FixedConnectorRead = 4,
    ArbitraryEgress = 8,
    MutateExternal = 16,
    GrantAccess = 32,
    RevokeAccess = 64,
    ManageAdmin = 128,
    GrantAdmin = 256,
}

One thing a tool call can do — the unit of the containment model.

The taxonomy is deliberately small and rarely changes. Adding a member means extending this enum and the two derivation functions (required_capabilities, granted_capabilities); the decision engine (decide) operates on sets generically and never needs to change (a pinned test demonstrates this).

Variants

LocalRead = 1

Read state confined to the conversation’s sandbox (workspace files).

LocalWrite = 2

Mutate state confined to the conversation’s sandbox (workspace writes, sandboxed shell). Destructive inside the box is still local.

FixedConnectorRead = 4

Call an operator-registered connector endpoint (or a first-party control-plane service) — a fixed destination the operator vouched for, carrying only model-authored arguments. Taint never revokes this.

ArbitraryEgress = 8

Send bytes to a model-controlled external destination — the built-in web/paid fetchers. The classic exfiltration channel.

MutateExternal = 16

Perform a side effect outside the sandbox: mutate external state, send a message, file an issue, spend money. An external mutation carries model-authored bytes to destinations an attacker may read, so it is an egress channel in effect even when the destination is fixed.

GrantAccess = 32

Grant a third party access to the system itself — the admin invite (#700). Deliberately held OUT of Self::ALL, so it is never in CapabilitySet::all, never in the default grant, and — because Self::from_name only recognizes members of Self::ALL — unnameable in operator config: no policy or wire input can ever seed it into a granted set. A tool that requires it therefore always exceeds its granted set and always escalates to a human, in every taint state and policy mode. This is the structural mechanism behind “an access-grant is never autonomous — a person always confirms the exact invitee”.

RevokeAccess = 64

Remove a third party’s access to the system itself — the admin de-admission (#713), the offboarding sibling of Self::GrantAccess. Held OUT of Self::ALL for the identical reason: never in CapabilitySet::all, never in the default grant, and unnameable in operator config (Self::from_name only recognizes Self::ALL members), so a tool requiring it always exceeds its granted set and always escalates to a human, in every taint state and policy mode. This is the structural mechanism behind “a removal is never autonomous — a person always confirms the exact person being removed”.

ManageAdmin = 128

Take away a persona’s ADMIN ROLE — the demote tool (#715), and the sibling that completes the admin-management set alongside Self::GrantAccess/Self::RevokeAccess. Held OUT of Self::ALL for the identical reason: never in CapabilitySet::all, never in the default grant, and unnameable in operator config (Self::from_name only recognizes Self::ALL members), so a tool requiring it always exceeds its granted set and always escalates to a human, in every taint state and policy mode. This is the structural mechanism behind “an admin’s role is never removed autonomously — a person always confirms exactly whose role is being taken away”.

This used to occupy the last bit u8 could hold (1 << 7); adding Self::GrantAdmin widened CapabilitySet (and this enum’s #[repr]) from u8 to u16, so a further marker needs no more widening — u16 has eight bits to spare.

GrantAdmin = 256

Make a persona an ADMIN — the promote tool (POLY-223), the admission-granting sibling of Self::ManageAdmin that completes the admin-management set alongside Self::GrantAccess/ Self::RevokeAccess. Held OUT of Self::ALL for the identical reason: never in CapabilitySet::all, never in the default grant, and unnameable in operator config (Self::from_name only recognizes Self::ALL members), so a tool requiring it always exceeds its granted set and always escalates to a human, in every taint state and policy mode. This is the structural mechanism behind “an admin role is never granted autonomously — a person always confirms exactly who is being made an admin.”

Deliberately its OWN marker rather than a reuse of Self::ManageAdmin: the escalation copy the gate renders is directional (see escalation_reason) — reusing ManageAdmin would make a PROMOTION’s approval card read “would take away someone’s admin role,” the opposite of what is actually being authorized.

Implementations

impl Capability

pub const ALL: [Self; 5]

Every grantable member of the taxonomy, in declaration order.

Self::GrantAccess and Self::RevokeAccess are deliberately absent: they are the never-granted markers (see their docs), so they are excluded from CapabilitySet::all, the default grant, name parsing (Self::from_name), and set iteration — everything driven off this array operates only over the grantable set.

pub const fn as_str(self) -> &'static str

Stable kebab-case name, used in signed approval coverage and telemetry. Inverse of Self::from_name.

pub fn from_name(name: &str) -> Option<Self>

Parse a stable kebab-case name; None for anything unrecognized so a caller reading operator config fails toward granting nothing.

Trait Implementations

impl Clone for Capability

fn clone(&self) -> Capability

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for Capability

impl Debug for Capability

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for Capability

impl FromIterator<Capability> for CapabilitySet

fn from_iter<I: IntoIterator<Item = Capability>>(iter: I) -> Self

Creates a value from an iterator.

impl Hash for Capability

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl Ord for Capability

fn cmp(&self, other: &Capability) -> Ordering

This method returns an Ordering between self and other.

fn max(self, other: Self) -> Self

where Self: Sized,

Compares and returns the maximum of two values.

fn min(self, other: Self) -> Self

where Self: Sized,

Compares and returns the minimum of two values.

fn clamp(self, min: Self, max: Self) -> Self

where Self: Sized,

Restrict a value to a certain interval.

fn clamp_to<R>(self, range: R) -> Self

where Self: Sized, R: ClampBounds<Self>,

🔬This is a nightly-only experimental API. (clamp_to)

Restrict a value to a certain range.

impl PartialEq for Capability

fn eq(&self, other: &Capability) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl PartialOrd for Capability

fn partial_cmp(&self, other: &Capability) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

Tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

Tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

Tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

Tests greater than or equal to (for self and other) and is used by the >= operator.

impl StructuralPartialEq for Capability